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Good morning, and thank you for the opportunity to provide comments regarding CCPA impacts 
on consumers and the advertising industry, in particular, and the digital economy in general. My 
name is Christopher Oswald, and I am the Senior Vice President of Government Relations at the 
Association of National Advertisers. 

The ANA is the advertising industry’s oldest trade association. ANA’s membership includes 
nearly 2,000 companies and marketing solutions providers, with 25,000 brands that engage 
almost 150,000 industry professionals and collectively spend or support more than $400 billion 
in marketing and advertising annually. Nearly every advertisement consumers see in print, 
online, or on TV is connected in some way to ANA members’ activities. In California, 
advertising helps generate $767.7 billion or 16.4% of the state’s economic activity and helps 
produce 2.7 million jobs or 16.8% of all jobs in the state. Our members include leading 
marketing data science and technology suppliers, ad agencies, law firms, consultants, and 
vendors. The ANA also counts among its membership a large number of nonprofits and charities 
that will be substantially affected by the CCPA, as they are highly dependent on the use of data 
provided by groups covered by the act to market and to reach donors effectively to fulfill their 
missions. Many of ANA’s members are headquartered in California or carry out significant 
business in California. 

The ANA strongly supports the underlying goals of the CCPA. Privacy is an extraordinarily 
important value that deserves meaningful protections in the marketplace. As an industry, we’ve 
taken a number of steps to put these values into practice—for instance, providing consumers 
control over data transparency with respect to the collection, use and transfer of data, and 
implementing strong self-regulatory bodies, such as the Digital Advertising Alliance, or “DAA”, 
to ensure accountability in the marketplace. As I noted during the January 14 th hearing in San 
Diego, as we look closely at the CCPA we are concerned that some aspects of the law will have 
unintended adverse consequences for consumers, businesses, and advertisers that will 
inadvertently undermine rather than enhance consumer privacy. During that hearing I urged you 
to: 

1. Permit a business to offer loyalty-based discount programs that consumers value and 
expect without the program constituting “discrimination” under the CCPA (Section 
1798.125). 

2. Recognize that a written assurance of CCPA compliance is sufficient and reasonable for 
ensuring the consumer has received “explicit notice” and is provided an opportunity to 
exercise the right to opt out of that sale (Section 1798.115(d)). 
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3. Clarify that businesses may offer reasonable options to consumers to choose the types of 
“sales” they want to opt-out of, the types of data they want deleted, or to completely opt- 
out—and not have to just provide an all-or-nothing opt-out option (Sections 1798.105 and 
1798.120). 

4. Clarify that individualized privacy policies for each consumer need not be created in 
order to disclose the “specific pieces of personal information the business has collected 
about that consumer” (Section 1798.110(c)). 

5. Refine the definition of the term “Personal Information.” Currently, the term creates 
tremendous ambiguity around what data is covered by the law (Section 1798.140(o)). 

Today, I add to that list three other important issues that we urge you to clarify during the 
rulemaking process: 

First, Section 1798.140(o)(l)’s definition of “personal information,” in combination with 
Section 1798.140(g)’s definition of “consumer,” suggests that the law will treat 
pseudonymized data in the same manner as data that could directly identify an individual. 

However, pseudonymized data does not include data types that individually identify a person, 
like name or email address. Instead, pseudonymized data is rendered in a manner that does not 
directly identify a specific consumer without the use of additional information. Pseudonymized 
data, therefore, does not raise the same privacy concerns as identifiable information. The CCPA 
could have the unintended effect of forcing business to associate non-identifiable, 
pseudonymized device data with a specific person seeking to exercise their CCPA rights. This 
approach would remove existing data privacy protections enjoyed by California residents 
pursuant to the DAA’s privacy program. We urge you to distinguish pseudonymized data from 
personal information while imposing DAA-like safeguards against the processing of 
pseudonymized data . This approach will help ensure California residents continue to benefit 
from existing privacy choices while helping to assure that data related to their online activities 
does not become identifiable. 

Second, Section 1798.140(y) and other sections of the CCPA allow for a person or entity 
that is “authorized by the consumer to act on the consumer’s behalf’ to make a deletion or 
access request for the consumer under the law. Our concern is that authorized third parties 
who make requests on behalf of consumers appear to be under no obligation to fully inform 
consumers of the implications of their choices, but they should be required to inform consumers 
of the practical results of making a CCPA request, since the business that will need to comply 
with the request will not be able to do so. Without such a requirement, consumers would not be 
able to make informed choices in the course of exercising their CCPA rights. ANA requests that 
you require authorized third parties that make CCPA requests on behalf of consumers to 
communicate information to consumers about the implications of the request. 

Third, Section 1798.105(d)(1) provides an exception to the deletion right for businesses that 
need a consumer’s personal information “in order to... provide a good or service requested 
by the consumer, or reasonably anticipated within the context of a business’s ongoing 



business relationship with the consumer.” This language does not clearly place marketing 
messages, such as subscription renewal reminders, within the purview of the exception. 
Consumers expect and value these messages. The ANA asks you to clarify that the deletion 
exception for providing a service requested by the consumer or reasonably anticipated by the 
consumer includes marketing messages, such as subscription renewal reminders. 

Thank you for the opportunity to speak today. There are a number of other areas of concern, and 
the ANA looks forward to submitting detailed written comments and working with you to 
develop implementing regulations for this important legislation. To the extent that there are 
needed changes identified in this submission to protect consumer privacy and other important 
interests that cannot be rectified by this rulemaking, but are better suited for legislation, we hope 
the AG will make such recommendations to the California Legislature. 

Thank you. 


